Add compile-time object_size checks as with FORTIFY _chk

[rurban]

With newer compilers and -D_FORTIFY_SOURCE>=2 check the dmax sizes at compile-time against __builtin_object_size (=BOS) compiler builtins, similar to the glibc and Bionic FORTIFY _chk functions, with gcc and newer clang. Just at compile-time already, not at run-time.

Add compile-time errors and warnings, and run-time warnings on --enable-warn-dmax if the 2 sizes deviate.

With clang-7 even add compile-time warnings and errors, without clang-7/diagnose_if defer to run-time.
The compile-time warning is a -Wuser-defined-warnings, and may be suppressed or increased to -Werror.

• error with "dmax exceeds dest" if dmax>BOS(dest). overflow even if dmax < RSIZE_MAX
• warn with ESLEWRNG "Wrong dmax" if dmax!=BOS(dest) with --enable-warn-dmax or clang-7.

A fatalized ESLEWRNG does not clear dest.

This might catch more wrong dmax, smax args, when the object-size is known at compile-time.
It it does no harm writing them out explicitly at the user call-site, it's even better. Yes, glibc disagrees, for the additional arg pass-thru performance hit. It's one single register/stack write.
An object may suddenly be dynamically malloced, and then glibc turns insecure, we not.

e.g.

char *dest[80];
strcpy_s(dest, 79, "1");

=> "strcpy_s: wrong dmax 79, dest has size 80" warnings to the invoke_safe_str_constraint_handler, only visible if a handler is installed.

See https://android-developers.googleblog.com/2017/04/fortify-in-android.html
esp. the new diagnose_if https://clang.llvm.org/docs/AttributeReference.html#diagnose-if